CVE-2026-124987
MEDIUM
NVD
CVSS Score
6.3
Severity
MEDIUM
Published
Nov 09, 2026
Vendor
unknown
Description
A vulnerability has been found in mikefarah yq up to 4.53.3. This affects the function Encode of the file pkg/yqlib/encoder_properties.go. Such manipulation leads to escaping of output. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.